ZE
Product
Zeppelin
26
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 4Medium 19Low 0
Watch
Add Zeppelin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44615 | 6.5 | Jul 31 | Path traversal in NotebookRepo note and folder path composition Affected: 0.9.0 before 0.12.1 |
| CVE-2026-44617 | 6.5 | Jul 30 | Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 Affected: 0.11.1 before 0.12.1 |
| CVE-2026-44616 | 6.5 | Jul 30 | Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction Affected: 0.6.0 before 0.12.1 |
| CVE-2024-31867 | 6.5 | Apr 9 | Apache Zeppelin: LDAP search filter query Injection Vulnerability Affected: 0.8.2 before 0.11.1 |
| CVE-2024-31865 | 6.5 | Apr 9 | Apache Zeppelin: Cron arbitrary user impersonation with improper privileges Affected: 0.8.2 before 0.11.1 |
| CVE-2024-31860 | 6.5 | Apr 9 | Apache Zeppelin: Path traversal vulnerability Affected: 0.9.0 before 0.11.0 |
| CVE-2021-28655 | 6.5 | Dec 16 | The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files Affected: through 0.9.0 |
| CVE-2026-44613 | 6.1 | Jul 30 | Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling Affected: 0.6.0 before 0.12.1 |
| CVE-2024-41177 | 6.1 | Aug 3 | Apache Zeppelin: XSS in the Helium module Affected: before 0.12.0 |
| CVE-2024-31868 | 6.1 | Apr 9 | Apache Zeppelin: XSS vulnerability in the helium module Affected: 0.8.2 before 0.11.1 |
| CVE-2021-27578 | 6.1 | Sep 2 | Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts Affected: before 0.9.0 |
| CVE-2018-1328 | 6.1 | Apr 23 | Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions Affected: before 0.8.0 |
| CVE-2021-28656 | 5.4 | Apr 9 | Apache Zeppelin: CSRF vulnerability in the Credentials page Affected: through 0.9.0 |
| CVE-2022-46870 | 5.4 | Dec 16 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in… Affected: before 0.8.2 |
| CVE-2024-51775 | 5.3 | Aug 3 | Apache Zeppelin: Command Injection via CSWSH Affected: 0.11.0 before 0.12.0 |
| CVE-2024-52279 | 5.3 | Aug 3 | Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string Affected: 0.11.1 before 0.12.0 |
| CVE-2024-31863 | 5.3 | Apr 9 | Apache Zeppelin: Replacing other users notebook, bypassing any permissions Affected: 0.10.1 |
| CVE-2024-31862 | 5.3 | Apr 9 | Apache Zeppelin: Denial of service with invalid notebook name Affected: 0.10.1 before 0.11.0 |
| CVE-2022-47894 | 5.3 | Apr 9 | Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE Affected: 0.8.0 before 0.11.0 |
Showing 19